The Governance Gap Issue #24
The Insurance Market Just Priced Your AI Risk. You Didn't.
THE TAKE
Two things happened this year that most boards are reading as pointing the same direction. In July, the EU's Digital Omnibus pushed the AI Act's high-risk conformity obligations from August 2026 to December 2027 for standalone systems and 2028 for embedded ones. Relief, broadly reported as such. Meanwhile the insurance market moved the other way: ISO introduced a generative AI exclusion for commercial general liability in January, absolute AI exclusions — language covering "any use, development, or deployment" of AI — have spread through directors and officers, employment practices, and fiduciary forms, and Verisk is now weighing exclusions written specifically for agentic AI.
Those facts point in opposite directions, and only one is durable. A regulatory deadline is political and subject to the next omnibus. A policy exclusion renews annually and gets broader, not narrower. The deferral also covers less than the headlines suggest: Article 50 transparency duties took effect August 2 as scheduled, prohibited-practice enforcement has been live since February 2025, and CISA is targeting September for the final CIRCIA rule with its 72-hour incident and 24-hour ransom payment clocks. What was deferred was paperwork. What arrived was liability.
Here is what boards are missing. The insurance market has become the fastest-moving AI regulator in the United States, and it regulates through price and coverage rather than statute — it moves in months, not legislative sessions, and nobody sends you a comment period. Much of the narrowing is happening quietly, through revised definitions and carve-backs rather than a conspicuous exclusion page. If you want to know what an AI governance standard looks like in 2027, read your Q4 underwriting questionnaire: system inventory, human oversight evidence, testing records, incident history — the same artifacts plaintiff's counsel will demand eighteen months later.
THREE THINGS BOARDS SHOULD KNOW
- Deferred is not repealed — the AI Act's high-risk conformity work moved to December 2027, but transparency obligations landed on schedule in August and the prohibited-practices regime has been enforceable since early 2025.
- D&O is the exposed flank — the broadest AI exclusions are appearing in the lines that protect directors personally, while cyber coverage has so far remained comparatively stable.
- Your renewal questionnaire is the real framework — underwriters are now setting the de facto AI governance bar, and they set it faster than any regulator will.
THE QUESTION I'M HEARING
"If an AI system we deployed causes a loss, are we covered?"
Less than you were last year, and probably less than your broker's summary suggests. The honest answer requires reading the actual forms — insuring agreements, definitions, carve-backs, and endorsements together — because the erosion is rarely sitting on the exclusions page where a summary would catch it.
Run one concrete exercise. Take a plausible scenario: an AI system you deployed produces a decision that draws a regulatory action and a shareholder suit. Trace that single claim across cyber, technology E&O, D&O, and general liability, and find where it lands and where it gets denied. In most portfolios I have seen recently, the claim finds a seam — cyber treats it as a professional services matter, E&O treats it as an AI output matter, and D&O has an absolute exclusion that swallows both.
My recommendation: before your next renewal, have the CISO and general counsel walk the board through that scenario jointly, in one sitting. If nobody in the room can say where the claim lands, you are carrying an uninsured operational risk that no one has priced — and you are carrying it in the year the market is repricing everything around it.
THE BOTTOM LINE
Regulators gave you a deadline extension; your underwriters gave you an exclusion. When the compliance calendar and the coverage form disagree, the coverage form is the one that shows up at the loss.